Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

nytimes.com

Post reply on HN
Print view View original

261–270 of 331 posts

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#261

Post by wavefunction »

_cs2017_ wrote: post #172
wavefunction wrote: post #162

Earlier quoted context omitted.

Making money off "mistakes" that keep happening, darn it!

I don't think they can make money off plain text passwords? They can only lose money from that, if it's discovered and they are fined and lose some users. They can make money from contact lists, but IIUC the article said they didn't use the contact lists. Also, given that it only affected a couple million users (like 0.1% of their user base), the damage to their reputation would far outweigh any benefits of actually…

how about extracting a user's contacts with their plaintext passwords that would usually be hashed into a database (at least in my professional experience) and thus unusable by facebook?

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#262

Post by wavefunction »

bastawhiz wrote: post #225
wavefunction wrote: post #162

Earlier quoted context omitted.

Making money off "mistakes" that keep happening, darn it!

Storing plain text passwords doesn't make them money, but it negatively affects users, should those passwords be compromised. Though FB didn't prosper from the mistake, users potentially feel a cost, so the outcome is the same. Criminal negligence might not benefit the bad actor, but it's still a crime either way.

or using the plaintext passwords to extract a user's contacts when hashing it into a database would prevent facebook from impersonating that user and logging in to access their non-facebook social graph?

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#263

Post by wavefunction »

UncleMeat wrote: post #198
wavefunction wrote: post #165

Earlier quoted context omitted.

I'm on a small team (5 engineers) that is GDPR compliant so no PII is logged. It's not hard if you care.

Its a lot easier on a small team. Security isn't a stable state.

I'm replying to the parent who made the opposite assertion

I can't f'in believe I have to explicate such simple things to supposedly intelligent and thoughtful people

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#264

Post by wavefunction »

munk-a wrote: post #72
fuzz4lyfe wrote: post #67

Earlier quoted context omitted.

Seems like a pretty trivial automated test for so many PHD's to miss: create_user('Bob', 'BobPassword123') assert "BobPassword123" not in logfile

Hrm, so you checked the apache access logs, or maybe an error log, what about the system logs? Does the login request spin up a bash script and pass the password to it? I don't think it's trivial to guarantee non-existence.

yeah well we're not running apache >wut is this post?

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#265

Post by trophycase »

jcims wrote: post #205
badrequest wrote: post #174

Earlier quoted context omitted.

as it so turns out, you can't rely on capitalism to even have any morality, much less enforce one

Eh, a capitalist system is going to reflect the moral framework of the participants. The participant here is the stock market, and its moral framework is based on economic growth and profit for shareholders. In that regard this was a good outcome and, as a result, is rewarded.

I try to think of it more as utterly sociopathic (in more or less the strict medical definition of the term), and things seem to really make a lot of sense under that framework.

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#266

Post by MarkMc »

It's interesting to consider the psychological aspect here. By publicly saying they expect a fine in the range $3-5 billion, Facebook increases the chance that the regulators ultimately decide on a figure in that range or close to it. This is an example of 'anchoring effect' : https://en.m.wikipedia.org/wiki/Anchoring

Given this effect, Facebook has an incentive to 'low-ball' their estimate.

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#267

Post by m463 »

AdmiralAsshat wrote: post #23

Seems like they should add another 0 to the fine after the recent hat trick: 1) Prompting users to give Facebook their email passwords.[0] 2) Using that email access to "inadvertently" upload the information of their email contacts.[1] 3) Storing said passwords and others in plaintext. [2] It's pretty impressive that a company could do something so brazenly malevolent and be confident that they will escape with no mo…

nothing linkedin hasn't done. (don't know about the plaintext passwords)

[I meant this as a serious observation, linkedin was sued but I believe they only got a mild slap on the wrist]

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#268

Post by tty2300 »

onlyrealcuzzo wrote: post #183
beatgammit wrote: post #164

Earlier quoted context omitted.

There definitely is a difference between someone accidentally tracking dog poo into your house vs someone doing it intentionally; in the first case, you all them to clean it up, and in the second case you break the friendship and/or seek criminal prosection. Likewise for big companies. If a company is acting badly, you need to figure out if it was intentional. In both cases you seek damages, but your approach to maki…

Right. That's like saying there's not a difference in involuntary manslaughter and murder. There is. Intent is very important. That's WHY so many people focus on the intention.

A logical reason to care about intent is that malicious people will likely do it again and can not be trusted in the future where as people who make a mistake will avoid doing it again

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#270

Post by misterman0 »

modriano wrote: post #259
scotchmi_st wrote: post #112

Earlier quoted context omitted.

Not to contradict your overall sentiment, but people often focus on intention with these issues. I think that's wrong. Like, if someone treads dog poo into my house on their shoes, it doesn't really matter if they did it by mistake, or spent ages walking around town trying to find some dog poo to step in before coming to my house; the effect is that there is now dog poo on my carpet. We need to be more dispassionate…

>Like, if someone treads dog poo into my house on their shoes, it doesn't really matter if they did it by mistake, or spent ages walking around town trying to find some dog poo to step in before coming to my house; the effect is that there is now dog poo on my carpet. So, whether it's your own two year old or a malicious adult, you think it's wrong to respond differently because they both produced the same harm?

I think it's not wrong to treat an adult exactly like you would a child if he's acting like one. I interpret parent poster as trying to make a point about how we cannot tell anything about intent so we should judge on the action, solely.
Post reply on HN